Classic298 3fe829acc2 fix: strip model params for read-only callers in the model list endpoint (#27004) ... The per-id model endpoint (GET /api/v1/models/model) strips params, the system prompt and other curated model config, for callers who only have read access. The list endpoint (GET /api/v1/models/list) did not: it returned each read-accessible model's full params, so a read-shared model exposed its params.system to non-owner read-grant holders. Mirror the per-id behaviour: compute write_access per item and drop params before serialising when the caller lacks write access (not the owner, not an admin under BYPASS_ADMIN_ACCESS_CONTROL and holding no write grant). The model-card list UI does not render params, so this does not change functionality. Co-authored-by: bogdancherniy11-sudo <229690748+bogdancherniy11-sudo@users.noreply.github.com>		2026-07-27 01:51:29 -04:00
..
data	refac: mv backend files to /open_webui dir	2024-09-04 16:54:48 +02:00
open_webui	fix: strip model params for read-only callers in the model list endpoint (#27004)	2026-07-27 01:51:29 -04:00
.dockerignore	fix: litellm config issue	2024-02-24 22:35:11 -08:00
.gitignore	refac	2024-09-06 04:59:20 +02:00
dev.sh	refac	2026-03-24 19:43:30 -05:00
requirements-min.txt	refac	2026-07-26 23:03:32 -04:00
requirements.txt	perf: stop resolving DNS on the thread pool (add aiodns) (#27440)	2026-07-26 23:29:52 -04:00
start.sh	refac	2026-06-17 03:01:11 +02:00
start_windows.bat	refac	2026-06-17 03:01:11 +02:00